Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-04-2021 19:45
Static task
static1
Behavioral task
behavioral1
Sample
PO.exe
Resource
win7v20210408
General
-
Target
PO.exe
-
Size
234KB
-
MD5
220dd8a37c0783d1e906525186ddc95c
-
SHA1
0153efd575f5ce0afeb5e8e7f40b6d0e0967e456
-
SHA256
7de63d57554daf81ef5bd3508fce96ae9d2eaae9bee30eb29d147095b3d9ea33
-
SHA512
5fab23a422fb69d302d4c60cc347007dee423af00657386a3a232ab7faadd70903d11ef7b3cfc957bad431b519bf205e328427f67af3a4303e25c9f009f2c224
Malware Config
Extracted
formbook
4.1
http://www.middlehambooks.com/klf/
podcastyourvote.com
northernlsx.com
guide4idiots.com
artebythesea.com
sapanyc.com
livinoutthedreamsco.com
thepowersinyou.com
protocolmodern.com
holdergear.com
betteringthehumanexperience.xyz
agnostec.com
royermaldonado.com
wealthtruckingco.com
artcode-software.com
microsoftpods.com
identityofplace.com
algoritas.com
grandpaurbanfarm.net
zahidibr.com
flawlessdrinking.com
amymako.com
tinymodeldiana.com
restoremyorigin.com
gyrostoyou.com
boiler-portal.com
aprilmarieclaire.com
midollan.com
finestfaux.com
lownak.com
okque.com
woodandresin.club
benficalovers.com
fangyu5827.com
tententacleshydro.com
oouuweee.com
sgsnit.com
fairisnotfair.com
shpwmy.com
238olive.com
4515a.com
frontrangetechnologies.com
v-travelclub.com
supportserverhotline23.info
snowandmotion.com
colinboycemp.net
yowoit.com
neopivot.com
singlebarrel.net
esdras-almeida.com
contecoliving.com
doctorsdietgulfport.com
issue72-paypal.com
pubgfrut.com
constipationhub.com
themodernspiritualgoddess.com
qzhongkong.com
bizcert360.com
nashvillegems.com
barryteeling.com
wzocflfor.com
mirrorsmarbella.com
nyariorganics.com
packtmall.com
100973671.review
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/580-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1504-72-0x00000000000D0000-0x00000000000FE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 752 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
PO.exepid process 1848 PO.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO.exePO.exewlanext.exedescription pid process target process PID 1848 set thread context of 580 1848 PO.exe PO.exe PID 580 set thread context of 1200 580 PO.exe Explorer.EXE PID 580 set thread context of 1200 580 PO.exe Explorer.EXE PID 1504 set thread context of 1200 1504 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
PO.exewlanext.exepid process 580 PO.exe 580 PO.exe 580 PO.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe 1504 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
PO.exePO.exewlanext.exepid process 1848 PO.exe 580 PO.exe 580 PO.exe 580 PO.exe 580 PO.exe 1504 wlanext.exe 1504 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO.exewlanext.exedescription pid process Token: SeDebugPrivilege 580 PO.exe Token: SeDebugPrivilege 1504 wlanext.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
PO.exePO.exewlanext.exedescription pid process target process PID 1848 wrote to memory of 580 1848 PO.exe PO.exe PID 1848 wrote to memory of 580 1848 PO.exe PO.exe PID 1848 wrote to memory of 580 1848 PO.exe PO.exe PID 1848 wrote to memory of 580 1848 PO.exe PO.exe PID 1848 wrote to memory of 580 1848 PO.exe PO.exe PID 580 wrote to memory of 1504 580 PO.exe wlanext.exe PID 580 wrote to memory of 1504 580 PO.exe wlanext.exe PID 580 wrote to memory of 1504 580 PO.exe wlanext.exe PID 580 wrote to memory of 1504 580 PO.exe wlanext.exe PID 1504 wrote to memory of 752 1504 wlanext.exe cmd.exe PID 1504 wrote to memory of 752 1504 wlanext.exe cmd.exe PID 1504 wrote to memory of 752 1504 wlanext.exe cmd.exe PID 1504 wrote to memory of 752 1504 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\PO.exe"C:\Users\Admin\AppData\Local\Temp\PO.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO.exe"C:\Users\Admin\AppData\Local\Temp\PO.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsiA112.tmp\55po.dllMD5
f8b51fd6f70455d07c7a53a8ace81744
SHA191aa6dfa7c86b36fa1ddf92852f52325c013616d
SHA2569cd220598c67347558abafebb4208c8c01c0ca692f517325bcc626e013d570ae
SHA51240ab512f99a557252c77bd87d9aae14183272cb3461db8658bda83800293695f54fc6aa7741c02eb280a11805fef5a762ea3cdc61c6ed5bc47cb67ce1aa1a972
-
memory/580-61-0x000000000041EB20-mapping.dmp
-
memory/580-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/580-65-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/580-66-0x0000000000340000-0x0000000000354000-memory.dmpFilesize
80KB
-
memory/580-68-0x00000000003A0000-0x00000000003B4000-memory.dmpFilesize
80KB
-
memory/752-73-0x0000000000000000-mapping.dmp
-
memory/1200-69-0x0000000006130000-0x0000000006230000-memory.dmpFilesize
1024KB
-
memory/1200-76-0x0000000007030000-0x0000000007192000-memory.dmpFilesize
1.4MB
-
memory/1200-67-0x0000000004A30000-0x0000000004B98000-memory.dmpFilesize
1.4MB
-
memory/1504-72-0x00000000000D0000-0x00000000000FE000-memory.dmpFilesize
184KB
-
memory/1504-70-0x0000000000000000-mapping.dmp
-
memory/1504-71-0x0000000000AF0000-0x0000000000B06000-memory.dmpFilesize
88KB
-
memory/1504-74-0x0000000001F10000-0x0000000002213000-memory.dmpFilesize
3.0MB
-
memory/1504-75-0x0000000000890000-0x0000000000923000-memory.dmpFilesize
588KB
-
memory/1848-59-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/1848-63-0x0000000002810000-0x000000000345A000-memory.dmpFilesize
12.3MB
-
memory/1848-62-0x0000000002810000-0x000000000345A000-memory.dmpFilesize
12.3MB